Buing an @ifixit.com kit looks cheap at first, but there's a hidden cost: None of the devices I open work afterwards 😬

md-tmpl - strongly typed markdown templates. Writing markdown templates has never been this error free. github.com/domenukk/md-... #markdown #prompt #templates

Cool stuff, binary-only fuzzing of iOS kernel yungraj.com/Fuzzing-macO...

This is absolutely nuts: hackers are hijacking high-profile Instagram accounts by simply asking Meta's AI chatbot to change the email on the account. Meta's AI does it, hacker gets password reset code, they're in. A staggering security issue www.404media.co/hackers-simp...

Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked

The exploit shows the extreme risk of offloading technical support to AI.

404media.co

everything is a bytecode-targetable virtual machine if you look at it sideways. JBIG2 image decompression? virtual machine. x86 mov instruction? virtual machine. truetype fonts? virtual machine. Magic: The Gathering? believe it or not, also virtual machine.

accidentally ended up on the news arstechnica.com/security/202...

Google publishes exploit code threatening millions of Chromium users

Google publishes exploit code before patch, reported 29 months earlier, is fixed.

arstechnica.com

Rebane@rebane2001.bsky.social · 3mo ago

back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member in edge, you wouldn't even notice anything out-of-place, and would stay connected to the c2 even after closing the browser

I'm sorry, what? In writing my first monograph, I spent six weeks trying to track down a citation in TWO languages I didn't know. And good thing too, because the citation was wrong. That's scholarship. That's research. You know, the thing we're trained to do?!?

My team on fire 🔥🔥

OffensiveCon@offensivecon.bsky.social · 3mo ago

Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space! by Xingyu Jin and Martijn Bogaard

the bun is now rusty, I repeat, the bun has been rusted: github.com/oven-sh/bun/...

Rewrite Bun in Rust by Jarred-Sumner · Pull Request #30412 · oven-sh/bun

Blog post with details coming soon. Still some optimization work to do before this lands in non-canary version. Still some cleanup work to do (which will come in a series of follow-up PRs)

github.com

Cool stuff, #go fuzzer powered by #LibAFL blog.trailofbits.com/2026/05/12/g...

Go fuzzing was missing half the toolkit. We forked the toolchain to fix it.

We built gosentry, a fuzzing-oriented fork of the Go toolchain that keeps the standard fuzzing workflow while using a stronger stack underneath.

blog.trailofbits.com

C has a borrow checker it’s called mythos

bun appear to be experimenting with a million line claude port from zig to rust lol

Comparing main...claude/phase-a-port · oven-sh/bun

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one - Comparing main...claude/phase-a-port · oven-sh/bun

github.com

Just cleaned my 1TB(!) cargo targets folder.. Lol.. How hard can it be to drop stale caches? 🦀🦀🦀 #rust

This paper finds that Rust on an microcontroller costs you about 10% extra flash space, actually saves you a bunch of RAM, and takes no extra time to deliver (as compared to C). Seems about right - especially as the C version needed a heap and the Rust version did not. arxiv.org/pdf/2604.25679

Original->

creepy (black box is me redacting the screenshot, it was 475 words of markdown pasted in)

Reminder! Today is the submission deadline for the first ever Conference of Synthetic Security Research @synsec_ai, so unless you want to gamble on a(nother) extension, warm up those agents and get those papers submitted!

AI is cooking to hard bughunters.google.com/blog/evolvin...

Blog: Evolving the Android & Chrome VRPs for the AI Era

We are announcing changes to the Chrome & Android Vulnerability Reward Programs (VRP) which take effect immediately and are focused on adjusting our reward amounts and bonuses to reflect the types of ...

bughunters.google.com

Our 2026 agenda is live! 🔗 offensivecon.org/agenda

LLMs are likely going to be the mediating lens through which large swathes of the population make sense of the world around them on political issues, & it's very bad that a man who has a strong case for being one of the worst people alive is one of the few to be actively trying to exploit this

Don't you just love it when your Agent announces everything works and then lists the six or seven failures it found and ignored..

AI is not going to flood you with real vuln reports unless you have a ton of real vulns. Adding resources to a vuln disclosure process to keep up with triage & bug fixing is a temporary investment at the loud end of the problem, not the right end.

🔥 Our academic keynote at #FUZZING'26 is online! Advancing from "What the fuzz?" to "All the Fuzz" by Mathias Payer (@gannimo.bsky.social). 🌍 fuzzing-workshop.github.io youtu.be/In3kRAVVbzQ?...

NDSS 2026 - FUZZING 2026, Welcome and Opening Remarks, and Keynote by Mathias Payer

YouTube video by NDSS Symposium

youtu.be

Very much in the mode where I'm hand-writing unsafe Rust code and shouting "PROVE ME WRONG" at Claude

Neat, even has #LibAFL integration github.com/cube0x8/PEMu...

GitHub - cube0x8/PEMutator: A Rust, format-aware, mutator for PE binary format.

A Rust, format-aware, mutator for PE binary format. - cube0x8/PEMutator

github.com

Apparently we're now obfuscating against LLM reversing www.elastic.co/security-lab...

The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation — Elastic Security Labs

Elastic Security Labs explores the ongoing arms race between LLM-driven reverse engineering and obfuscation.

elastic.co

The fuzzer that found project-zero.issues.chromium.org/issues?q=com... (and a number of issues prior to that as well) is now open-source: crrev.com/c/7580844 It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

Watchdogs say the previous CEO model suspiciously started slowing down immediately after the announcement chaser.com.au/business/app...

i got irritated at the ceremony to go from a freshly-created KVM to "can run x86-64 machine code like normal" so i've wrote a small library for exactly that: codeberg.org/iximeow/asml...

asmlinator

just enough glue on top of KVM to get a VM with one CPU set up to execute `x86_64` instructions.

codeberg.org

If only there was a way to automate security

Claude Mythos AI unauthorised access claim probed by Anthropic

The AI company has said the model is too dangerous to release publicly because of its hacking capabilities.

bbc.com